TA505

Names and who uses them

• TA505Our name
• CHIMBORAZOMicrosoft
• Spandex TempestMicrosoft
• Hive0065MITRE ATT&CK

Known techniques

• T1027.002Software Packing
• T1027.010Command Obfuscation
• T1027.013Encrypted/Encoded File
• T1055.001Dynamic-link Library Injection
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.005Visual Basic
• T1059.007JavaScript
• T1069Permission Groups Discovery
• T1071.001Web Protocols
• T1078.002Domain Accounts
• T1087.003Email Account
• T1105Ingress Tool Transfer
• T1106Native API
• T1112Modify Registry
• T1140Deobfuscate/Decode Files or Information
• T1204.001Malicious Link
• T1204.002Malicious File
• T1218.007Msiexec
• T1218.011Rundll32
• T1486Data Encrypted for Impact
• T1552.001Credentials In Files
• T1553.002Code Signing
• T1553.005Mark-of-the-Web Bypass
• T1555.003Credentials from Web Browsers
• T1559.002Dynamic Data Exchange
• T1566.001Spearphishing Attachment
• T1566.002Spearphishing Link
• T1568.001Fast Flux DNS
• T1583.001Domains
• T1588.001Malware
• T1588.002Tool
• T1608.001Upload Malware
• T1685Disable or Modify Tools

Malware and tools used